# PHP's Git Server Hacked To Add Backdoors To PHP Source Code

**URL:** <https://onehack.st/t/phps-git-server-hacked-to-add-backdoors-to-php-source-code/177024>\
**Category:** News & Articles\
**Tags:** programming\
**Created:** [March 30, 2021, 9:25am UTC](https://onehack.st/t/phps-git-server-hacked-to-add-backdoors-to-php-source-code/177024 "2021-03-30T09:25:57Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [March 30, 2021, 9:25am UTC](https://onehack.st/t/phps-git-server-hacked-to-add-backdoors-to-php-source-code/177024/1 "2021-03-30T09:25:57Z")

</div>

[![](https://www.bleepstatic.com/content/hl-images/2021/03/29/PHP-headpic.jpg) ](https://www.bleepstatic.com/content/hl-images/2021/03/29/PHP-headpic.jpg)

[dotancohen](https://developers.slashdot.org/~dotancohen) writes:

_Late Sunday night, on March 28, 2021, Nikita Popov, a core PHP committer, [released a statement](https://news-web.php.net/php.internals/113838) indicating that two malicious commits had been pushed to the php-src Git repository. These commits were pushed to create a backdoor that would have effectively [allowed attackers to achieve remote code execution through PHP and an HTTP header](https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/)._ “The incident is alarming considering PHP remains the server-side programming language to power over 79% of the websites on the Internet,” adds BleepingComputer.

“In the malicious commits [[1](https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a?branch=2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a&diff=unified#diff-a35f2ee9e1d2d3983a3270ee10ec70bf86349c53febdeabdf104f88cb2167961R368-R370), [2](https://github.com/php/php-src/commit/c730aa26bd52829a49f2ad284b181b7e82a68d7d#diff-a35f2ee9e1d2d3983a3270ee10ec70bf86349c53febdeabdf104f88cb2167961R370)] the attackers published a mysterious change upstream, ‘fix typo’ under the pretense this was a minor typographical correction. However, taking a look at the added line 370 where zend\_eval\_string function is called, the code actually plants a backdoor for obtaining easy Remote Code Execution (RCE) on a website running this hijacked version of PHP.”

According to Popov, the first commit was detected a couple hours after it was made, and the changes were reverted right away. “Although a complete investigation of the incident is ongoing, according to PHP maintainers, this malicious activity stemmed from the compromised [git.php.net](http://git.php.net) server, rather than compromise of an individual’s Git account,” reports BleepingComputer. “As a precaution following this incident, PHP maintainers have decided to migrate the official PHP source code repository to GitHub.”